Active Users

User Sessions

RDP Sessions

Failed Logons

Print Jobs

USB Events

Screenshots

Sysmon Events

Network Clients

Data Source Warnings

Sysmon: NO DATA (not yet deployed or no agent data)

User Activity (Domain Authentication)

Times show first/last authentication activity. Sessions = activity bursts separated by 30+ minute gaps.

User	Sessions	First Active	Last Active	Computer / IP
Marian Alfons	4	7:36 AM	3:49 PM	192.168.2.166, MARIAN-PC
MDM.11	5	8:00 AM	2:12 PM	192.168.2.226, DESKTOP-SR790VT
Karan	4	8:01 AM	2:12 PM	192.168.2.127, KARAN-WAREHOUSE
Dalia Sidhom	1	9:11 AM	9:11 AM	192.168.128.61
Mina Iscandar	3	9:39 AM	11:26 AM	192.168.128.3, 535b081ed3ad, MDM-SERVER
Helena Awad	3	10:06 AM	4:47 PM	DESIGNER-PC
David Mikhail	3	10:10 AM	3:07 PM	192.168.128.3, 535b081ed3ad, DESKTOP-ACDS751
Ragy Awadallah	1	11:04 AM	11:04 AM	ACCOUNTING
Nervine Wassef	2	11:05 AM	3:15 PM	192.168.2.3, ACCOUNTING
Atef Awad	1	11:53 AM	12:21 PM	ATEF-PC
svc-openclaw	1	12:42 PM	12:42 PM	mdm-openclaw
Hany Abdelmalek	1	1:45 PM	1:46 PM	HANY-PC

Remote Desktop Sessions (Guacamole / RDP)

User	Sessions	First	Last	From
David Mikhail	2	10:10 AM	3:07 PM	192.168.128.3
MDM.11	1	8:28 AM	8:28 AM	192.168.2.226
Mina Iscandar	1	9:40 AM	9:40 AM	192.168.128.3
Karan	1	8:04 AM	8:04 AM	192.168.2.127

Failed Logon Attempts

User	Failures	Source
administrator	18	MICHAELS-MACBOOK-AIR.LOCAL
administrator@MDM.local	9	MICHAELS-MACBOOK-AIR.LOCAL
hani@mdmcontracting.ca	7	HANY-PC
Fady Gorgy	6	FADY-ELECTRIC
Karan	2	192.168.2.127
GUEST	2	MAC-67D77C
Marian Alfons	1	MARIAN-PC

Top Applications (Server)

User	Application	Launches
-	autochk.exe	1
-	LsaIso.exe	1
David Mikhail	MSACCESS.EXE	3
David Mikhail	acregl.exe	1
-	Registry	1

Server Session Activity (Lock/Unlock)

RDP session lock/unlock events on the server only. Workstation activity is tracked separately via agent.

User	First Activity	Last Activity	Duration	Locks
Karan	8:10 AM	8:10 AM	<1m	1
David Mikhail	10:23 AM	3:21 PM	5h 57m	11
Mina Iscandar	10:27 AM	11:35 AM	1h 7m	3

DNS Top Sites

Client	Domain	Queries
192.168.2.166	mpc2-prod-29-is5qnl632q-uc.a.run.app	2
MDM-Server	1108-ms-7.54-2a58d.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.616-168f35.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.692-18b234.57176317-47d8-11f1-939d-2cea7f579a3a	1
192.168.2.166	analytics.google.com	8
MDM-Server	1108-ms-7.1024-245777.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.338-c4d2b.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.845-1e0e07.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.10-1ad52.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.416-efdc4.57176317-47d8-11f1-939d-2cea7f579a3a	1
192.168.2.166	sc-static.net	2
ATEF-PC	config.teams.microsoft.com	2
MDM-Server	1108-ms-7.979-22ff0b.57176317-47d8-11f1-939d-2cea7f579a3a	1
192.168.2.166	googleads.g.doubleclick.net	8
192.168.2.166	www.bing.com	6
MDM-Server	1108-ms-7.846-1e0e17.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.682-1878d4.57176317-47d8-11f1-939d-2cea7f579a3a	1
MDM-Server	1108-ms-7.654-17abb1.57176317-47d8-11f1-939d-2cea7f579a3a	1
Local	ocsp.digicert.com	2
192.168.2.166	tr.snapchat.com	4

Print Jobs

User	Document	Printer	Pages	Time
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:46 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:45 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:45 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:44 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:43 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:43 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:43 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:42 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:42 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:42 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:41 AM
David Mikhail	Print Document	Guacamole Printer (redirected 10)	1	10:40 AM
Karan	Print Document	HP054C2B (HP LaserJet Pro M428-M429) (redirected 5)	1	8:10 AM

Workstation Activity (Agent)

KARAN-WAREHOUSE () — 1 snapshots, avg idle: 0s

ATEF-PC () — 1 snapshots, avg idle: 0s

NERVINE-PC () — 1 snapshots, avg idle: 0s

HANY-PC () — 1 snapshots, avg idle: 0s

EHAB-PC () — 1 snapshots, avg idle: 0s

DESIGNER-OFFICE () — 1 snapshots, avg idle: 0s

DESKTOP-SR790VT () — 1 snapshots, avg idle: 0s

Network Traffic (Meraki)

Client	IP	Sent (MB)	Received (MB)	Total (MB)
e2af154d-7471-4303-8cad-503d12b52df7	192.168.2.197	0	0.5	0.6
b412f05a-7acf-40e3-b4e2-62e4bb1e0e97	192.168.2.226	0.5	1.2	1.7
bc:24:11:4a:c0:1c	192.168.2.37	0	0	0
Marian-pc	192.168.2.166	0.1	1	1.1
bc:24:11:f8:9b:11	192.168.2.38	0	0	0
b984b422-d17f-40c2-9458-fb4aa6f79170	192.168.2.72	0.2	0.4	0.6
bc:24:11:75:84:57	192.168.2.20	2.1	0.1	2.2
HS200	192.168.2.133	0	0	0
bc:24:11:27:69:05	192.168.2.29	0	0	0.1
BB8836102	192.168.2.73	0	0	0
bc:24:11:e3:39:cf	192.168.2.35	1.1	0	1.1
eff042fd-9791-4be0-a2f0-fe323e4290ee	192.168.2.168	0	1	1
Designer-Office	192.168.2.11	0	0.1	0.1
Karan-Warehouse	192.168.2.127	0.1	1	1.1
bc:24:11:4d:e6:c6	192.168.2.27	0	0	0

Microsoft 365 Activity

Email & Teams data is from May 03 (yesterday — Microsoft reports have a ~24h processing delay). Sign-ins are real-time.

Email Activity (May 03)

User	Sent	Received	Read	Last Active
Mina Iscandar	2	2	2	2026-05-03
Nervine Wassef	1	14	1	2026-05-03
David Guirguis	0	4	0	2026-05-01
Ehab Guirguis	0	24	11	2026-05-03
Atef Awad	0	7	4	2026-05-03
Michael Guirguis	0	18	1	2026-05-03
Hani Abdelmalek	0	7	0	2026-05-01
Dalia Sidhom	0	3	1	2026-05-03
Ehab Kodsi Guirguis	0	6	1	2026-05-03
Mahmoud Assi	0	2	0	2026-05-01
Mina Iscandar	0	2	0	2025-03-17

Sign-In Activity

User	App	Location	Status	Last Time
David Guirguis	Cloudflare Access	Mississauga, CA	Failed (501314)	May 04 12:06 PM
Michael Guirguis	Cloudflare Access	Mississauga, CA	Success	May 04 10:45 AM
Dalia Sidhom	One Outlook Web	Mississauga, CA	Success	May 04 1:20 PM
Mahmoud Assi	Office365 Shell WCSS-Client	Toronto, CA	Success	May 04 4:50 PM
David Guirguis	Cloudflare Access	Mississauga, CA	Success (2x)	May 04 12:09 PM
Dalia Sidhom	Office365 Shell WCSS-Client	Mississauga, CA	Success (12x)	May 04 1:25 PM
Helena Awad	One Outlook Web	Mississauga, CA	Success	May 04 2:42 PM
David Mikhail	One Outlook Web	Toronto, CA	Success	May 04 1:59 PM
Dalia Sidhom	App Home Pages Prod	Mississauga, CA	Success	May 04 1:24 PM
Mahmoud Assi	SharePoint Online Web Client Extensibility	Toronto, CA	Success	May 04 4:51 PM
Michael Guirguis	Azure Portal	Mississauga, CA	Success (20x)	May 04 10:54 AM
Michael Guirguis	Microsoft Teams Web Client	Mississauga, CA	Success	May 04 12:40 PM
Dalia Sidhom	SharePoint Online Web Client Extensibility	Mississauga, CA	Success	May 04 1:24 PM
Hani Abdelmalek	One Outlook Web	Mississauga, CA	Success	May 04 1:46 PM
Atef Awad	Microsoft Teams Web Client	Mississauga, CA	Success	May 04 3:12 PM
Helena Awad	Office365 Shell WCSS-Client	Mississauga, CA	Success	May 04 2:42 PM

File Access (Shared Drives)

No file access events recorded. Data will appear once users access audited shares.

Daily Activity Report

Data Source Warnings

User Activity (Domain Authentication)

Remote Desktop Sessions (Guacamole / RDP)

Failed Logon Attempts

Top Applications (Server)

Server Session Activity (Lock/Unlock)

DNS Top Sites

Print Jobs

Workstation Activity (Agent)

KARAN-WAREHOUSE () — 1 snapshots, avg idle: 0s

ATEF-PC () — 1 snapshots, avg idle: 0s

NERVINE-PC () — 1 snapshots, avg idle: 0s

HANY-PC () — 1 snapshots, avg idle: 0s

EHAB-PC () — 1 snapshots, avg idle: 0s

DESIGNER-OFFICE () — 1 snapshots, avg idle: 0s

DESKTOP-SR790VT () — 1 snapshots, avg idle: 0s

Network Traffic (Meraki)

Microsoft 365 Activity

Email Activity (May 03)

Sign-In Activity

File Access (Shared Drives)